Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
728a38b1e33be01830cc6fd4cd853b65_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
728a38b1e33be01830cc6fd4cd853b65_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
728a38b1e33be01830cc6fd4cd853b65_JaffaCakes118.html
-
Size
25KB
-
MD5
728a38b1e33be01830cc6fd4cd853b65
-
SHA1
9b8547c5e93128fc6c514949f5ad3872d12b1252
-
SHA256
27879eab82fe3cfbd3e04141226ba4028123aad565cf100e3d4f13fba1123d32
-
SHA512
3914f796b5678d4f4eaa6ee3321a85966bc80be8d7aa16b7d740f63a94037d8318afea424b56b82f46ab11c8143f691c4ef689ed74c486e62f0d62c19a3ace97
-
SSDEEP
768:IRdaBj41CQPaDKjwGHTj4BTsHqEuT++hYSOuz:nY+KjwGHTj4FsHqxrmS5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008a2ffb790c7146d5d28ae4d87cd0140b567d071e278ff6c561ece9cada3ee942000000000e800000000200002000000042c1ca60292c77614f8bccaf906f304c29b9db9e5e7584d8d9174b08ff9ec73890000000fb2418d1843dd46c51939f6ac3e7fc62706ea7d1155af2d6524ea322a57226a53d82b5aa22b490b6f4654562f696c8c80239bd077aea20f4cba1ac03e1e44f2002f61b9c509d0dce2fce8a87a3f1f31f8a8122641e29a9b231d5cebff152e4f8eb1fa9b5f4f47dd4c82cf9a4d245d4495202e439b36dc18b5fd586172df53ccc6776d6a7c2c2cd861154a0c6dc885e294000000014dc581231dfde88cccb43e710a31de8a4b1b0b7c15123848c988ec738f5ac9d05a9b30def323ee01ec66e541ca1083f3f581d90089d18d1d7ffeb368795325e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B67F621-1AB2-11EF-91AC-F2A35BA0AE8D} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422815725" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000070c48d84e323bf3530ec316621fb643e0a9be432f50f2076d64226eff0193c5000000000e8000000002000020000000a65c333a15ba001cd09eea7339e4353009e1e419b71e1ca0e796e68f343206f920000000a54c4ec93c6f16343a7995148f989bd19badc143cb146bd22bd4301ac119de42400000005448c4c550e422b180d006b314c2ee9e473a73b6c720c57b882b23b85e8862a67217a2fc2178fb7c323264402e28130ae64a279849be8ec5f9a3bf19c74d786c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cc0523bfaeda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2628 2956 iexplore.exe 28 PID 2956 wrote to memory of 2628 2956 iexplore.exe 28 PID 2956 wrote to memory of 2628 2956 iexplore.exe 28 PID 2956 wrote to memory of 2628 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\728a38b1e33be01830cc6fd4cd853b65_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
867B
MD5c5dfb849ca051355ee2dba1ac33eb028
SHA1d69b561148f01c77c54578c10926df5b856976ad
SHA256cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA51288289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d442fb460242bb01fd7a655d44f2c64
SHA145199399d23d282cd5e99a8c554d44fa5c67a82b
SHA256fd7f7a81ecc7d4a8cfd2c414f30de415eff430752bcd2ca916d9cd74bd07d6c6
SHA51279053c3ae9130c8202d3d58a8a5523f0b4da947f932293985909fca6337ba213acb0f9e4ba738be8dcf775dbc422b45890cbfdce969df1c486d15e749746f74c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5386807ddf780e64b84a495ad1dbe29bb
SHA1eca9ef310d0f62737c58f98f062759606d16197a
SHA25622edf2aad205b90a61c94fe62ba60a5a9098c31bb84bef685c6309d1d3f52d5d
SHA5123a8b9fbf370088cbb324345969e2d1406b97fade9db56733113d3319cac8103ebf6a64c649d7a31b6eb53992bc8c1d816aabe29b98f8ab6c099302d8cdf29750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e256a4a37f55aabd99c2e4e17662ad5b
SHA12ed83563ad74d803230f84d43788aad0ec08c0b4
SHA256e9bd2db275c574a5518bebd9ba61efd594e808523f2fc478d6b10f8a84b68673
SHA512ab136b7e91324b0bb0b3bbd0ee689d38edcb4a4203bf21ed244ebd50ffb41e7ea8591cb7cf6d0a0d66aca01b201a93a0ba1e0e049cf83846e0178767bee7233c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aa754b10d97b95c1b2eaca6ba1cb5f0
SHA1f4fe3084a96af6a992ac114b46edb987a92b2a19
SHA25685709a818ed4ac93cc3cbc9865ffe9096ed892b6f309332c8e3bc427906b1dfe
SHA512ed90d6bb5121fa2297803a2bc47a2138d13295f89092c96192b58f94da658289875573ba347a0b3c3ba627b30926949cedf60b3ff540af88ce4b4c613daca734
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0e28c89e598d1d01845be02d0de9d18
SHA1864f7a9db5180fd4d5a331e3af8503787c944699
SHA256454f69a2a32d797365b76830be5464e8cc5aa89b55657a995b930ecaef060732
SHA512223ebe61671a5b4e6365801d009e5f1f5c726b8ed34994b59e778f295c0e139b050c51d729cf499101f3982b613acbd8083d834d8819d60ed7134aaf3765a1e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b487de1a40ccd7bf62085572d19e281d
SHA1b8c28fc4a930d301b19df52992df3bcb8f84e9a1
SHA256ec295320b96792d3ddda3f8fd9d43946ffc5288959584488cce7af4aae650304
SHA512a35885345ce616fa60b507aa321c24fdbb66b1edd79e036bf476f1ba44a0120bf66c5cd7f850c32e34b6f6623c3ea03a4fb2d59e5eb04fa2ba19be531f74f2af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf28b0b07766582b60725ee57b7dfcd1
SHA198cadb6f3e63eb076780f5216ff03f6fad96f9ea
SHA256c1237ba66ae53514dee51b7fd75ccf1c2ac547c43c270f4d3fa508a5fe525d3b
SHA51263d5f6ba4929cd556655568e99f807e79ae91cc3123c7268cc2111fdde077b546991558e87b47427ba446362df9ca459191138761230442f815340663eab1a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d013ce2aad3131f396c4cd548003e11a
SHA1535fc090a113eb266ca5a2c7365859f1d1c7a39e
SHA2567eee1fe7a19beb1a6dd5d572e53536ae699c76a61e41b82f0980fbc837f9967c
SHA5129599b9eddff7c4ba6b10c9ec24fb08d54150d456fb6c1c1abf4e2ea082067252caa43ceaa31aacff4904df8343d46ab2e43b9c7c4ea30b4470f870d39820144d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eefa864a1fca8d30f9d2322451c1424
SHA1b2d7c293b9dd7c2ab6262af48332d07322f5073e
SHA25617eabddf0b5c589a2fa9173f7cdc6c2927e423f3e7c785a3f3870d73bb8188ac
SHA512094046e2449f5adb14d45c1bac82e8b873c0f8e877e4a0c8e56ca384fe581302ebf22add1c22bb5320bc9844ddb8ec9468e0c1be18f306e6d96ffc57bbd2aabb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5759804d6c5352aead3effc92d9dea1e2
SHA1e81ce04e42133a9c03b30f1436f1452b45f7f530
SHA25664ff799526429209446dbb2dd5453bebd8cc55bd9e621d7f904cc7b7cc74b463
SHA5129f9180ddf38a53507d0a41ffe98c6adfeb76c2cdfd3e62cae5547fa641360d96c7f2bac272ccc01440a2b4a1b9bc77e2fb757e9bca3986c1182e34b8e99bf0f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a728fdfd5ac3d77b1eefc33588b02429
SHA1a4202b29f477bccdcc7baed413d34b424cea6046
SHA2565baf171e2a9163a3874e7686ac958d3e07b79f6d4240aabbfbe11084d9740b25
SHA5128f5f94775dbd44271e13d0ede11a6339aba16878b457763c15a1851ec9947cc4fef9f678dc59cf626aebbeffa7dc87605b6ba6a410685206b3be3a1b63e2c299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559f29312df90ef9d03fabcb6ee20a98e
SHA1ab500fd6c853296c2520428cc018560959f9727c
SHA2565aa9f25dde5a770beaa5ed62abb79443622a7351eff3ce4a2027a7e25700ad08
SHA5125397459f82b0a6985047730a8d96d4d2635d86dbb98676426bf01e33d15975c78d3fb5c2b6f8c2f87841ad474976d674af4b82ceab174e64cfb5fa5b0cf08d3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54526d436d4803a90988ba6bef088d355
SHA1445c070fb4db7f7cddebdeefa11731eeaf56837a
SHA25686aa6fd2298d54af2fca9c45d1b8e04dd5ef5b668389380e138eb7845cc39f01
SHA512579ce3bc4bf592fa96d68001ae97f843999e03d7676b638ca8eaff2de440de3a5e9a3ccefcedf53c0276eeb00e83311c83136b6d0e851dea964290c89d271656
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d409c94b434d842622e0b384c97525b6
SHA1584c20337437d2e9bd440502aca681db9a57bfe8
SHA256cc76b6b27b90fe4d331abffaf99e09ce0a7207377fd9cd539dcfe9929aac4ec0
SHA51256253235249af4325e1735c6eeb80eecea48764356a3376b4d5bcca04a158028228c1c9a0d5b7c501ad6cc796bed6450f17d32d1b22761d4d3a3a3ed996d060f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50382791bf945e62344ee6d025dfb5f22
SHA182e10dcfad954e986f93cb6bd8adb8a81dfc526d
SHA256b4c5bd4396e3acdd626ecca3772cef8c81a3c71cb70c65e0e81786e90ba2846f
SHA51298450ffdb0fa459d7a2d0916af99b7afef1c36afb0e5c806f6af55f99bc40118190d9b6a50c09ed16b0c1570b0ad5ea7240cbe6c4128d3f2be153bfc029a7ca9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5208ed87de71e31dbe29ff3de0899f245
SHA169114be17b5ab127b31b7b39785e1b6590f911e4
SHA25690806148ca2a1bdbe0f07e4b71c7fdc8845699c2a0ddb38b88b8abb6a6f2c949
SHA5120f68780840c4c92793847bdb77d73d23160c37a6ba5fd18117c4c9d1bc378d0f72b90573b2eb240896a0f7465ee01326f48d018dee2956ad389127be47acc50a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b29698ac2bcabfb7f6e012f53c8f5f23
SHA1bb90d5021c433e706340f488bdc145595b4ee865
SHA25645866ea8474dddfbed1d0c2944d0dd92374da3133f39db8f88f5d351c0e0b3dd
SHA512b34d86692367debff71214c0ab3a5fc6335a5e20753cb2ba39b470e4736f173f5acba422b180bf96d50e29eb07e319ff2bc15590e57faafacf94bd875c653b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize242B
MD57e49c2a6a5b125bef86915d7012b5a88
SHA1466c8367ac5035e5f8ce2890c03459bc932b5a89
SHA256f31233f570cc1765bf995cd8e70819ed5c438dd78fe34c2efa1d499a81fd6ac2
SHA512711f0841282565682f55f7a502b808a94f6b6f2a69984f770daeeb2497fbbf8a5bd7d4cd44c577e4a97a907bc520302354866c8ee53b98d4aba4ba3f6b69abfe
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a